Utah § 63A-19-401.3 Privacy program report.

Utah Statutes

§ 63A-19-401.3 — Privacy program report.

Utah § 63A-19-401.3

Title 63AUtah Government Operations Code

Ch. 63A-19Government Data Privacy Act

Part 63A-19-4Duties of Governmental Entities

This text of Utah § 63A-19-401.3 (Privacy program report.) is published on Counsel Stack Legal Research, covering Utah primary law. Counsel Stack provides free access to over 12 million legal documents including statutes, case law, regulations, and constitutions.

Bluebook

Utah Code Ann. § 63A-19-401.3 (2026).

Text

(1)On or before December 31 of each year, the chief administrative officer of each governmental entity shall prepare a report that includes:

(1)(a) whether the governmental entity has initiated a privacy program;

(1)(b) a description of:

(1)(b)(i) any privacy practices implemented by the governmental entity;

(1)(b)(ii) strategies for improving the governmental entity's privacy program and practices; and

(1)(b)(iii) the governmental entity's high-risk processing activities;

(1)(c) a list of the types of personal data the governmental entity currently shares, sells, or purchases;

(1)(d) the legal basis for sharing, selling, or purchasing personal data;

(1)(e) the category of individuals or entities:

(1)(e)(i) with whom the governmental entity shares personal data;

(1)(e)(ii) to whom the gov

Free access — add to your briefcase to read the full text and ask questions with AI

(1) On or before December 31 of each year, the chief administrative officer of each governmental entity shall prepare a report that includes:
(1)(a) whether the governmental entity has initiated a privacy program;
(1)(b) a description of:
(1)(b)(i) any privacy practices implemented by the governmental entity;
(1)(b)(ii) strategies for improving the governmental entity's privacy program and practices; and
(1)(b)(iii) the governmental entity's high-risk processing activities;
(1)(c) a list of the types of personal data the governmental entity currently shares, sells, or purchases;
(1)(d) the legal basis for sharing, selling, or purchasing personal data;
(1)(e) the category of individuals or entities:
(1)(e)(i) with whom the governmental entity shares personal data;
(1)(e)(ii) to whom the governmental entity sells personal data; or
(1)(e)(iii) from whom the governmental entity purchases personal data;
(1)(f) the percentage of the governmental entity's employees that have fulfilled the data privacy training requirements described in Section 63A-19-401.2; and
(1)(g) a description of any non-compliant processing activities identified under Subsection 63A-19-401(2)(a)(iv) and the governmental entity's strategy for bringing those activities into compliance with this part.
(2) The report described in Subsection (1):
(2)(a) shall be considered a protected record under Section 63G-2-305; and
(2)(b) may be made available at the request of the office.